CVE-2026-59962
Received Received - Intake

Path Traversal in Tandoor Recipes Application

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: GitHub, Inc.

Description
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, passes unvalidated sort_order and order_field strings into Django ORM order_by() calls when an authenticated user supplies foreign-key traversal paths in recipe search, RecipeBook, or stored CustomFilter ordering values. Request processing uses _finalize_ordering and order_by through 8080/api/recipe/ and 8080/api/recipe-book/. The attack works because Django interprets double-underscore ordering fields as related-table traversal, and observable result ordering leaks values from related User fields. This can infer password hashes, email addresses, administrator status, and other related database values. This issue is fixed in version 2.6.10.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-59962
EUVD
EUVD-2026-102949

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
TandoorRecipes recipes < 2.6.10

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-943 The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an ORM ORDER BY Injection vulnerability in Tandoor Recipes affecting versions before 2.6.10. It allows authenticated users to inject arbitrary field names, including foreign-key traversal paths, into Django ORM order_by() calls via sort_order and order_field parameters. Django interprets double-underscore fields as related-table traversal, enabling data leakage from related User fields like password hashes, email addresses, and admin status.

Detection Guidance

Check Tandoor Recipes version with: curl -s http://your-server/api/version/ | grep version. If version is below 2.6.10, the system is vulnerable. Inspect API logs for suspicious order_by parameters containing double underscores like created_by__password or created_by__email.

Impact Analysis

An attacker could extract sensitive data such as password hashes, email addresses, administrator status, and last login times from the database by observing the ordering of search results or recipe book entries. This could lead to account compromise, privilege escalation, or exposure of personal information.

Compliance Impact

This vulnerability could lead to unauthorized access and exposure of personal data, violating GDPR's data protection principles and HIPAA's safeguards for protected health information. Organizations using affected versions may face compliance violations, regulatory fines, and reputational damage due to data breaches.

Mitigation Strategies

Upgrade Tandoor Recipes to version 2.6.10 or later immediately. Review API endpoints for /api/recipe/ and /api/recipe-book/ to ensure no custom order parameters are accepted. Restrict user access to sensitive fields and monitor for unusual database queries.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-59962. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart